Add on.steps and on.permissions support for pre-activation job step injection#21219
Merged
Add on.steps and on.permissions support for pre-activation job step injection#21219
on.steps and on.permissions support for pre-activation job step injection#21219Conversation
…activation job Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add support for front matter field 'on.steps' in pre-activation job
Add Mar 16, 2026
on.steps support for pre-activation job step injection
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for a new on.steps front matter field that injects user-defined steps into the pre-activation job and exposes their step-status via pre-activation job outputs.
Changes:
- Extend workflow data model and orchestrator parsing to capture
on.steps. - Ensure pre-activation job is created when
on.stepsis present, append injected steps after built-in checks, and auto-wire outputs. - Update YAML frontmatter extraction and JSON schema to allow/comment out
on.steps, and add tests for the new behavior.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/on_steps_test.go | Adds unit/integration-style tests validating injection, ordering, and output wiring for on.steps. |
| pkg/workflow/frontmatter_extraction_yaml.go | Comments out on.steps (and its contents) in the compiled on: YAML block like other gh-aw-specific fields. |
| pkg/workflow/compiler_types.go | Adds WorkflowData.OnSteps to carry parsed injected steps. |
| pkg/workflow/compiler_pre_activation_job.go | Appends on.steps into pre-activation steps, wires per-step outputs, and handles the “on.steps-only” pre-activation case; adds extractOnSteps. |
| pkg/workflow/compiler_orchestrator_workflow.go | Extracts on.steps during processOnSectionAndFilters into WorkflowData. |
| pkg/workflow/compiler_jobs.go | Ensures pre-activation job is created when on.steps is present. |
| pkg/parser/schemas/main_workflow_schema.json | Extends schema to allow on.steps and documents how to reference the wired outputs. |
Comments suppressed due to low confidence (1)
pkg/workflow/compiler_pre_activation_job.go:356
- Job outputs are wired to
${{ steps.<id>.result }}, but GitHub Actions step contexts exposeoutcome/conclusion(andoutputs.*), not aresultfield. This will produce an empty/invalid output at runtime. Consider wiring to${{ steps.<id>.outcome }}(orconclusion, depending on the desired semantics) and update docs/tests accordingly.
for _, id := range onStepIDs {
outputKey := id + "_result"
outputs[outputKey] = fmt.Sprintf("${{ steps.%s.result }}", id)
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
342
to
346
| @@ -319,6 +345,17 @@ func (c *Compiler) buildPreActivationJob(data *WorkflowData, needsPermissionChec | |||
| maps.Copy(outputs, customOutputs) | |||
| } | |||
| if len(data.OnSteps) > 0 { | ||
| compilerActivationJobsLog.Printf("Adding %d on.steps to pre-activation job", len(data.OnSteps)) | ||
| for i, stepMap := range data.OnSteps { | ||
| stepYAML, err := c.convertStepToYAML(stepMap) |
pkg/workflow/on_steps_test.go
Outdated
| } | ||
|
|
||
| // Verify the output is wired | ||
| if !strings.Contains(lockContentStr, "gate_result: ${{ steps.gate.result }}") { |
Contributor
|
@copilot review agentic workflows that use a separate job to conditionally if the activation job (top level if) and determine if the job can be converted in steps to save 1 job |
…puts take precedence Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Reviewed the 5 workflows that use a separate pre-computation job gated by ✅ Convertible to
❌ Not suitable for
Key limitation: Also fixed two bugs in commit
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
Contribution Guidelines Check ✅Hey Here's a quick checklist summary:
Verdict: 🟢 Aligned — this PR looks ready for maintainer review. The implementation touches exactly the right files (
|
Contributor
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…est case Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit
on:
issues:
types: [opened]
permissions:
issues: read
steps:
- name: Gate check
id: gate
uses: actions/github-script@v8
with:
script: |
# GitHub API calls here using issues: readA self-reference bug was also fixed: Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Copilot
AI
changed the title
Add
Add Mar 16, 2026
on.steps support for pre-activation job step injectionon.steps and on.permissions support for pre-activation job step injection
Contributor
|
@copilot review code changes, update docs in deterministic agent pre filtering |
…d deterministic patterns guide Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in commit
|
Contributor
|
@copilot make sure you consistently use result or outcome , don't confuse them. |
…ding examples Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in commit
The doc examples were also fixed: the outcome-based examples now use a step that actually exits non-zero on failure ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds new
on.stepsandon.permissionsfront matter fields that inject custom steps and permissions into the pre-activation job, enabling inline gate checks that can conditionally suppress activation — saving one workflow job compared to using a separate pre-computation job.Behavior
on.stepscreates a pre-activation job if one doesn't already existidgets an auto-wired output<id>_result: ${{ steps.<id>.outcome }}(values:success/failure/cancelled/skipped)jobs.pre-activation.outputstake precedence over auto-wiredon.stepsoutputs on key collisionon.stepsis the only reason for pre-activation,activatedoutputs'true'unconditionally — the user controls agent execution via their ownif:conditionon.permissionsmerges additional permission scopes into the pre-activation job (e.g.,issues: readfor GitHub API calls inon.steps)steps:andpermissions:keys are commented out in the compiledon:trigger section (like other gh-aw-specific fields)if: needs.pre_activation.outputs.*conditions in the front matter are correctly deferred to downstream jobs and not incorrectly applied to the pre_activation job itselfUsage
To expose arbitrary step output values alongside the auto-wired outcome, use
jobs.pre-activation.outputs:Changes
compiler_types.go: AddedOnSteps []map[string]anyandOnPermissions *PermissionstoWorkflowDatacompiler_pre_activation_job.go: Appendson.stepsto pre-activation steps; auto-wires<id>_resultoutputs usingsteps.<id>.outcome; wires auto outputs before merging custom outputs so explicit user config wins; mergeson.permissionsinto pre-activation job permissions; addsextractOnSteps,extractOnPermissions, andreferencesPreActivationOutputsfunctionscompiler_jobs.go: AddshasOnStepsas a condition to trigger pre-activation job creationcompiler_orchestrator_workflow.go: PopulatesOnStepsandOnPermissionsduringprocessOnSectionAndFiltersfrontmatter_extraction_yaml.go: Comments outon.stepsandon.permissionsin the compiledon:section; guards event-section entering checks when insideon.permissionsoron.stepsto prevent false matches on nested keys (e.g.,issues: readinsideon.permissions)main_workflow_schema.json: Addsstepsandpermissionsproperties to theon:object schemaissue-monster.md: Convertedsearch_issuescustom job toon.steps, saving one workflow jobon_steps_test.go: Integration and unit tests covering all new behaviors includingon.permissionsandreferencesPreActivationOutputsguides/deterministic-agentic-patterns.md: Updated "Custom Trigger Filtering" section —on.steps:is now the primary recommended approach (saves 1 job); multi-job pattern documented as "For Complex Cases"; addedon.permissions:usage examplereference/triggers.md: Added### Pre-Activation Steps (on.steps:)and### Pre-Activation Permissions (on.permissions:)sections with full documentation and examplesreference/frontmatter.md: Addedsteps:andpermissions:to theon:field summary listOriginal prompt
🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.